Whole installer

src/plugin/AdblockPlusClient.cpp

 #include "PluginStdAfx.h"
 #include "PluginSettings.h"
 #include "PluginSystem.h"
 #include "PluginFilter.h"
 #include "PluginClientFactory.h"
 #include "PluginMutex.h"
 #include "PluginClass.h"
 
 #include "AdblockPlusClient.h"
 
@@ skipping 26 matching lines @@
         else
         {
           throw std::runtime_error("Out of memory");
         }
     }
 
     BOOL createProcRes = 0;
     // Running inside AppContainer?
     if (acs != NULL && acs->TokenAppContainer != NULL)
     {
-      // Launch with default security. Registry entry will eat the user prompt
+      // We need to break out from AppContainer. Launch with default security - registry entry will eat the user prompt
       // See http://msdn.microsoft.com/en-us/library/bb250462(v=vs.85).aspx#wpm_elebp
-      LPWSTR stringSid;
-      ConvertSidToStringSidW(acs->TokenAppContainer, &stringSid);
-      params.Append(L" ");
-      params.Append(stringSid);
-      LocalFree(stringSid);
       createProcRes = CreateProcessW(engineExecutablePath.c_str(), params.GetBuffer(params.GetLength() + 1),
                               0, 0, false, 0, 0, 0, (STARTUPINFOW*)&startupInfo, &processInformation);
     }
     else
     {
-      // Launch with the same security token (Low Integrity) explicitly
+      // Launch with Low Integrity explicitly
       HANDLE newToken;
       DuplicateTokenEx(token, 0, 0, SecurityImpersonation, TokenPrimary, &newToken);
 
+      PSID integritySid = 0;
+      ConvertStringSidToSid(L"S-1-16-4096", &integritySid);
+      std::tr1::shared_ptr<SID> sharedIntegritySid(static_cast<SID*>(integritySid), FreeSid); // Just to simplify cleanup
+
+      TOKEN_MANDATORY_LABEL tml = {};
+      tml.Label.Attributes = SE_GROUP_INTEGRITY;
+      tml.Label.Sid = integritySid;
+
+      // Set the process integrity level
+      SetTokenInformation(newToken, TokenIntegrityLevel, &tml, sizeof(TOKEN_MANDATORY_LABEL) + GetLengthSid(integritySid));
+
+      STARTUPINFO startupInfo = {};
+      PROCESS_INFORMATION processInformation = {};
+
       createProcRes = CreateProcessAsUserW(newToken, engineExecutablePath.c_str(), params.GetBuffer(params.GetLength() + 1),
                               0, 0, false, 0, 0, 0, (STARTUPINFOW*)&startupInfo, &processInformation);
     }
 
     if (!createProcRes)
     {
       throw std::runtime_error("Failed to start Adblock Plus Engine");
     }
 
     CloseHandle(processInformation.hProcess);
@@ skipping 424 matching lines @@
 bool CAdblockPlusClient::TogglePluginEnabled()
 {
   DEBUG_GENERAL("TogglePluginEnabled");
   Communication::InputBuffer response;
   if (!CallEngine(Communication::PROC_TOGGLE_PLUGIN_ENABLED, response)) 
     return false;
   bool currentEnabledState;
   response >> currentEnabledState;
   return currentEnabledState;
 }